Both underscores (because against standard) and SHA-1 (because old and weak) were removed from browsers.

On underscores: https://www.digicert.com/blog/digicert-pushes-underscore-ext...

On SHA-1: https://blog.mozilla.org/security/2015/10/20/continuing-to-p...

Mmm, rather than the behaviour being "removed from browsers" the important thing is that Certificate Authorities were told that issuing such certificates could cause them to be distrusted as a whole by browsers.

Part of the reason to do this is that if CAs issue the certificates then their customers buy them, and create pressure to accept them. If none of the CAs are willing to issue this never comes up.

Another is "unknown unknowns". Security systems don't play well with undefined behaviour, if we explicitly forbid everything we don't want to exist that minimises the risk of such undefined behaviour anywhere in the certificate handling code getting exploited. It's a defence in depth.